Siemens HMI Password Reset: Recover Locked Control Panel Access

1. Problem: Siemens HMI Control Panel Locked by Unknown Password

When a SIMATIC HMI operator panel (OP, MP, TP, KP, or Comfort series) is protected with a Control Panel password and the credentials are lost, the operator can no longer reach the connection settings (Ethernet, MPI, PROFIBUS, PROFINET) needed to download a corrected project. Typical field symptoms include:

• Control Panel dialog prompts for a password before allowing the user to change the transfer mode, IP address, subnet mask, or PROFINET device name.
• Recipe screens, trend views, and login pages reject operator edits with "incorrect password" even though the project password in TIA Portal was correct.
• Start Center "Transfer" button is grayed out or returns "Authorization failed" when a download is attempted from TIA Portal or WinCC flexible.
• Recipe data is locked because the recipe password was assigned on the panel and never synchronized back to the engineering project.

Two distinct passwords are involved, and they must be treated separately:

2. Identify the Panel Family and Firmware

Before any reset, determine the panel's order number (MLFB) and firmware version. The boot logo, Start Center logo, and the back-label give clues:

Match the firmware against the TIA Portal / WinCC flexible image on your engineering PC. Mismatched firmware is the most common cause of an aborted download even after the password is cleared. The firmware version is shown in the Start Center's System Information tile, or in the Control Panel > System > Device tab.

3. Default and Reserved Passwords for SIMATIC HMI Panels

Siemens documentation explicitly publishes a small set of factory passwords used by service and support technicians. These are the only values that should be tried before performing a destructive reset:

If a non-default password was written into the panel at some point, the entries above will be rejected. The panel is then considered service-locked and only a recovery procedure can clear the prompt.

4. Recovery Path 1: Soft Reset via Start Center

On panels where the Start Center is still reachable (no password on the Start Center itself, but the Control Panel is locked), the soft reset is the fastest route:

1. Tap Start Center > Settings (wrench icon).
2. If the Control Panel demands a password, tap Cancel and instead enter Start Center > System > Reboot. The reboot alone does not clear the password, but it forces any stale authentication cache to reload.
3. Open Control Panel > OP (or HMI) > Transfer / Settings. On TP 170B and later panels the dialog name is "OP Properties".
4. Check the box "Restore factory settings" or "Reset to factory defaults". A warning dialog appears stating that the runtime project, recipes, and passwords will be deleted.
5. Confirm with Yes. The panel reboots twice and returns to a clean Start Center.

This works on every Win CE-based panel whose Start Center is accessible. The Linux-based Unified Comfort Panels (MTP family) replace this path with the boot-menu recovery covered in Section 7.

5. Recovery Path 2: Reset to Factory via ProSave (Ethernet)

When the Control Panel itself is locked but the panel still has a working IP address and the Enable Remote Control / Remote Reset option is set, ProSave is the cleanest path. ProSave is delivered with every WinCC flexible / TIA Portal installation and is located at:

• C:\Program Files\Siemens\Automation\WinCC flexible\WinCC flexible Support Tool\ProSave.exe (WinCC flexible)
• C:\Program Files\Siemens\Automation\Portal V[xx]\Bin\ProSave.exe (TIA Portal)

1. Connect the engineering PC to the panel's PROFINET/Ethernet port directly or through a managed switch. Do not connect both ports of a Comfort Panel to the same subnet — the integrated switch will drop the packets.
2. Configure a compatible IP address on the PC (e.g. panel default 192.168.0.1 / PC 192.168.0.10). On Comfort Panels the default IP is 192.168.0.2 with mask 255.255.255.0.
3. Launch ProSave. In the General tab set:
   • Device type: the exact MLFB (e.g. TP1200 Comfort).
   • Connection: Ethernet, then Settings > IP address of the target system.
4. Open the OS Update tab. Tick "Reset to factory settings" (German UI: Auf Werkseinstellungen zurücksetzen).
5. Click Update OS. ProSave uploads a fresh image, partitions the flash, and reboots the panel. Runtime project, recipes, logs, and the Control Panel password are erased.

6. Recovery Path 3: OS Update via USB or PROFIBUS

If Ethernet is unavailable or the IP stack is corrupted, perform the OS update from a USB stick or via PROFIBUS. The image files are stored under C:\Program Files\Siemens\Automation\Portal Vxx\HmiImages\ with the pattern <MLFB>.<firmware>.img (Comfort and MTP) or <MLFB>.<firmware>.fwf (legacy Win CE panels).

6.1 USB Recovery (Comfort / Unified Comfort)

1. Copy the panel's image file onto a FAT32 USB stick (max 32 GB, single partition).
2. Power off the panel.
3. Hold the panel's Service / Reset button (located behind the front bezel on the right side; use a 2.5 mm pin).
4. Apply power while keeping the button held. After ~10 s the Start Center displays a yellow "Service Mode" banner.
5. Insert the USB stick. The bootloader enumerates USB1 and lists all matching *.img files.
6. Select the correct firmware and press OK. The bootloader formats the internal flash and writes the image. Do not power off during this process — the panel is unbrickable only by Siemens support once the bootloader partition is corrupted.

6.2 PROFIBUS Recovery (Legacy MP 27x / MP 37x)

1. Connect the panel's PROFIBUS port to the PC's CP 5611 / CP 5613 / CP 5621 or a Softnet card.
2. Set the panel's PROFIBUS address on the Start Center (if reachable) to a unique value, e.g. 2.
3. In ProSave select Connection > PROFIBUS, enter the address, and tick Reset to factory settings in the OS Update tab.
4. ProSave handles the rest using the S7Online interface.

7. Recovery Path 4: Boot Menu and "Reset Password" on Unified Comfort Panels

The Unified Comfort Panels (MTP700, MTP1000, MTP1200, MTP1500, MTP1900, MTP2200) run on a Linux RT and do not honor a Windows-style service button. Their recovery console is reached as follows:

1. Power off the panel.
2. Hold a finger on the upper-left corner of the touch screen while applying power.
3. Keep the finger pressed until the Boot Loader overlay appears (about 5 s). The overlay is a 50 %-transparent menu with options Boot Project, Reset to Factory Defaults, Update Firmware, and Reset Password.
4. Choose Reset Password. The Linux security module restores the default user admin with password admin and removes any custom user administration that was loaded from the runtime project.
5. If the touch is not working, connect a USB keyboard and use the arrow / Enter keys. The boot loader listens on USB HID regardless of touch calibration state.

8. Re-download the Project with a New Password

After the panel is unlocked, redeploy the project with passwords that are managed inside the engineering tool. The project password and the recipe password must be defined before compilation:

1. Open the project in TIA Portal (or WinCC flexible for legacy panels).
2. Navigate to Project tree > [HMI] > Runtime settings > Security > User administration.
3. Add or modify the user group "Administrators" and set its password. To disable the Control Panel prompt entirely, leave the password field empty in Control Panel access in the project properties.
4. For recipe passwords open Recipes > [Recipe] > Properties > Password and enter the new value.
5. Compile the project and transfer it. In TIA Portal: Online > Compiled HMI tags > Download to device. Tick Overwrite all to replace recipes that were locked in the field.
6. On the panel, open Start Center > Transfer if the download does not start automatically, and accept the certificate.

9. Recovering the Recipe Database

The factory reset erases internal recipe storage. If a backup was not made, recipes may still be recoverable from the engineering project:

• Recipes stored inside the project file (.ap16 / .hmi) survive a panel reset. Re-deploy the project and the original recipe data reappears.
• Recipes that were edited on the panel (operator-changed values) are lost unless a CSV export was made. The CSV can be imported back via Recipes > [Recipe] > Import on the panel.
• For Comfort Panels running firmware V14 or later, Siemens WinCC Audit / SIMATIC Logon can replicate recipe changes to a central SQL store and restore them after a factory reset.

10. Security Best Practices for SIMATIC HMI

1. Document every password in the plant's HMI password register. Siemens offers the SIMATIC HMI Password Manager add-on (article 6AV2 178-1BA20-0AA0) that exports and encrypts the project's user database.
2. Disable Control Panel access in the project settings for operator-class panels. Maintenance access is then only possible via the engineering tool with a project password.
3. Set the Auto Logout time to a value that matches the shift pattern. Default 5 minutes is fine for process panels; shift panels should use 30 minutes to avoid operator lockout.
4. Keep firmware on a current release. Siemens issues password-related fixes in the HMI firmware; for example firmware V17.0.0.6 for Comfort Panels fixed a CSV import crash that could force a reset. Check the firmware changelog under "Security updates" in the Siemens support portal.
5. For Unified Comfort Panels, enable the Security-by-Default flag (TIA Portal > HMI > Runtime settings > Security > Use default security settings) so the panel ships with a unique admin password instead of the legacy admin/admin default.

11. Troubleshooting Matrix

12. Verification Checklist

1. Start Center opens without prompting for a password.
2. Control Panel > OP Properties shows default IP, default transfer mode, and no user-defined name.
3. TIA Portal Online > Accessible nodes lists the panel by PROFINET name and IP.
4. Project compiles cleanly and downloads with status Transfer completed (0 errors, 0 warnings).
5. Runtime starts, all recipe views load, and the new administrator password is accepted.
6. On a sample operator login, the panel logs the user off after the configured idle time.